diff --git a/lib/pki_temp.cpp b/lib/pki_temp.cpp
index a2cabefe..8900d5ae 100644
--- a/lib/pki_temp.cpp
+++ b/lib/pki_temp.cpp
@@ -191,12 +191,14 @@ void pki_temp::fromExtList(extList *el, int nid, const char *item)
 {
 	QString target;
 	el->genConf(nid, &target, &adv_ext);
-	if (nid == NID_subject_alt_name || nid == NID_issuer_alt_name) {
+	if (nid == NID_subject_alt_name || nid == NID_issuer_alt_name ||
+	    nid == NID_name_constraints)
+	{
 		QStringList sl = target.split(",");
+		QRegularExpression match("([a-z]+;)*otherName:msUPN;UTF8:");
 		for (int i=0; i<sl.size(); i++) {
 			QString s = sl[i].trimmed();
-			if (s.startsWith("otherName:msUPN;UTF8:"))
-				sl[i] = s.replace("otherName:msUPN;UTF8:", "UPN:");
+			sl[i] = s.replace(match, "\\1UPN:");
 		}
 		target = sl.join(",");
 	}
diff --git a/lib/x509v3ext.cpp b/lib/x509v3ext.cpp
index c3c5b880..a4aaa84c 100644
--- a/lib/x509v3ext.cpp
+++ b/lib/x509v3ext.cpp
@@ -83,12 +83,12 @@ x509v3ext &x509v3ext::create(int nid, const QString &et, X509V3_CTX *ctx)
 			if (new_san.size() > 0)
 				etext.replace(QString("DNS:copycn"), new_san.join(","));
 		}
-		if (nid == NID_subject_alt_name || nid == NID_issuer_alt_name) {
+		if (nid == NID_subject_alt_name || nid == NID_issuer_alt_name || nid == NID_name_constraints) {
 			QStringList sl = etext.split(",");
+			QRegularExpression match("([a-z]+;)*UPN:");
 			for (int i=0; i<sl.size(); i++) {
 				QString s = sl[i].trimmed();
-				if (s.startsWith("UPN:"))
-					sl[i] = s.replace("UPN:", "otherName:msUPN;UTF8:");
+				sl[i] = s.replace(match, "\\1otherName:msUPN;UTF8:");
 			}
 			etext = sl.join(",");
 		}
diff --git a/widgets/NewX509.cpp b/widgets/NewX509.cpp
index e5f67e7c..5642841e 100644
--- a/widgets/NewX509.cpp
+++ b/widgets/NewX509.cpp
@@ -1142,7 +1142,7 @@ void NewX509::on_editNameCons_clicked()
 {
 	QStringList permut;
 	for (const QString &group : QStringList { "permitted", "excluded" }) {
-		for(const QString &type : QStringList { "URI", "email", "RID", "DNS", "IP" }) {
+		for(const QString &type : QStringList { "URI", "email", "RID", "DNS", "IP", "UPN", "othername" }) {
 			permut << QString("%1;%2").arg(group).arg(type);
 		}
 	}